The Office of the Superintendent of Financial Institutions (OSFI) is consulting on the draft guideline B‑13 on technology and cyber risk management. The proposed guideline sets out expectations for sound technology and cyber risk management across five domains. Each domain is guided by a desired outcome and related technology-neutral principles that collectively contribute to operational resilience. The Annex to the consultation letter also sets out the feedback OSFI received as a result of the Fall 2020 discussion paper on technology and related risks. The comment period for this consultation ends on February 09, 2021.
The expectations outlined in the guideline aim to support federally regulated financial institutions in developing greater resilience to technology and cyber risks in the areas of—
- Governance and Risk Management: Covers expectations for the formal accountability, leadership, organizational structure, and framework used to support risk management and oversight of technology and cyber security
- Technology Operations: Sets expectations for management and oversight of risks related to the design, implementation and management of technology assets and services.
- Cyber Security: Covers expectations for management and oversight of cyber risk
- Third-Party Provider Technology and Cyber Risk: Expands on he existing OSFI guidance for outsourcing and third-party risk, to set expectations for institutions that engage with third-party providers to obtain technology and cyber services and/or other services that give rise to cyber and/or technology risk
- Technology Resilience: Sets expectations for capabilities to deliver technology services through operational disruption
Comment Period: February 09, 2021
Keywords: Americas, Canada, Banking, Cyber Risk, Guideline B-13, Operational Resilience, Governance, Operational Risk, Regtech, OSFI
Previous ArticleHM Treasury Issues Proposals on Future Regulatory Framework Review
The European Banking Authority (EBA) published the final draft regulatory technical standards specifying and, where relevant, calibrating the minimum performance-related triggers for simple.
The European Central Bank (ECB) is undertaking the integrated reporting framework (IReF) project to integrate statistical requirements for banks into a standardized reporting framework that would be applicable across the euro area and adopted by authorities in other EU member states.
The European Banking Authority (EBA) has been awarded the top European Standard for its environmental performance under the European Eco-Management and Audit Scheme (EMAS).
The Monetary Authority of Singapore (MAS) set out the Financial Services Industry Transformation Map 2025 and, in collaboration with the SGX Group, launched ESGenome.
The Basel Committee on Banking Supervision met, shortly after a gathering of the Group of Central Bank Governors and Heads of Supervision (GHOS), the oversight body of BCBS.
The International Organization of Securities Commissions (IOSCO) welcomed the work of the international audit and assurance standard setters—the International Auditing and Assurance Standards Board (IAASB)
The Bank of England (BoE) published a Statistical Notice (2022/18), which informs that due to the Bank Holiday granted for Her Majesty Queen Elizabeth II’s State Funeral on Monday September 19, 2022.
The French Prudential Control and Resolution Authority (ACPR) announced that the European Banking Authority (EBA) has updated its filing rules and the implementation dates for certain modules of the EBA reporting framework 3.2.
The European Central Bank (ECB) published a paper that examines how credit rating agencies accepted by the Eurosystem, as part of the Eurosystem Credit Assessment Framework (ECAF)
The Australian Prudential Regulation Authority (APRA) announced reduction in the aggregate Committed Liquidity Facility (CLF) for authorized deposit-taking entities to ~USD 33 billion on September 01, 2022.